Add authentication: admin/agent bearer tokens for the API, login for the dashboard

control-api: every route now carries a mandatory access level (admin / agent /
open) in a route table. All /api/v1/admin/* require the admin token; the
write calls of validator-agent and prober (self-check, events, results,
complete) require a separate static agent token; register, heartbeat and
fetching the assignment stay open. Tokens come from env vars, are compared in
constant time and never logged. An empty token leaves that level open with a
startup warning (backward compatible).

validator-agent / prober: apiclient sends the agent token only to control-api.

admin-dashboard: login/password (from env) with a stateless HMAC session
cookie, Origin-based CSRF check, per-IP brute-force throttle, HX-Redirect for
htmx polls, logout in the sidebar; the dashboard calls control-api with the
admin token. Login page layout fixed after review.

Also: env plumbing in docker-compose/rxprod-compose/systemd/config examples,
e2e script with token assertions, tests, docs (API, SETUP, USAGE, DASHBOARD,
README), plan and review under docs/changes/, bin/ rebuilt with new
SHA256SUMS.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/agentcore/agentcore.go

@@ -53,6 +53,13 @@ func New(cfg *config.ValidatorAgent, log *slog.Logger) *Agent {
 	}
 }
 
+// WithToken sets the bearer token sent to the Control API (and only to it:
+// the IP-echo lookup and all check traffic use separate clients).
+func (a *Agent) WithToken(token string) *Agent {
+	a.client.Token = token
+	return a
+}
+
 // Run registers with the Control API and polls forever until ctx is
 // cancelled.
 func (a *Agent) Run(ctx context.Context) error {

internal/agentcore/agentcore_test.go

@@ -98,3 +98,34 @@ func TestRegisterWithRetryStopsOnCancel(t *testing.T) {
 		t.Fatalf("expected context.Canceled, got %v", err)
 	}
 }
+
+// TestTokenGoesOnlyToControlAPI: the bearer token authenticates calls to
+// control-api, and must never leak to the external IP-echo service.
+func TestTokenGoesOnlyToControlAPI(t *testing.T) {
+	var apiAuth, echoAuth atomic.Value
+	api := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		apiAuth.Store(r.Header.Get("Authorization"))
+		w.Write([]byte(`{"ok":true,"poll_interval_seconds":5}`))
+	}))
+	defer api.Close()
+	echo := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		echoAuth.Store(r.Header.Get("Authorization"))
+		w.Write([]byte("203.0.113.7"))
+	}))
+	defer echo.Close()
+
+	a := New(&config.ValidatorAgent{ValidatorID: "val-1", ControlAPIURL: api.URL}, testLogger()).WithToken("agent-secret")
+	ctx := context.Background()
+	if err := a.registerWithRetry(ctx); err != nil {
+		t.Fatalf("register: %v", err)
+	}
+	if _, err := fetchIPEcho(ctx, echo.URL); err != nil {
+		t.Fatalf("fetchIPEcho: %v", err)
+	}
+	if got, _ := apiAuth.Load().(string); got != "Bearer agent-secret" {
+		t.Fatalf("control-api Authorization = %q, want bearer token", got)
+	}
+	if got, _ := echoAuth.Load().(string); got != "" {
+		t.Fatalf("IP-echo request carried Authorization %q, want none", got)
+	}
+}